File name:

letsvpn-latest.exe

Full analysis: https://app.any.run/tasks/c1906a86-3fb0-4e70-9ae7-000621a9ae26
Verdict: Malicious activity
Analysis date: May 31, 2025, 20:24:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
antivm
upx
websocket
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

2939BBD79EB890F2E55A8BA9E541672B

SHA1:

FD7D8577D46391A8198F5CCD382CC177267CA7BB

SHA256:

7FEBAB9593FFB7D1CD0A36F1B6029C0A7D3695664595D5693D787AE774C1B3D0

SSDEEP:

196608:c/PFu0fVmKbOkOisgbxI1VfVOuWIzU1K2zZaw:YI0ftbOkOPgb6dOXSUFZD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • letsvpn-latest.exe (PID: 6072)

    • Antivirus name has been found in the command line (generic signature)

      • powershell.exe (PID: 7852)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6920)
      • cmd.exe (PID: 7036)

    • Changes the autorun value in the registry

      • iusb3mon.exe (PID: 1672)

    • UAC/LUA settings modification

      • iusb3mon.exe (PID: 1672)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7956)

    • Changes powershell execution policy (Bypass)

      • LetsVPN.exe (PID: 2104)

  • SUSPICIOUS

    • Get information on the list of running processes

      • irsetup.exe (PID: 3884)

    • Executable content was dropped or overwritten

      • letsvpn-latest.exe (PID: 2772)
      • irsetup.exe (PID: 3884)
      • 7z.exe (PID: 132)
      • LetsVPN.exe (PID: 2104)
      • tapinstall.exe (PID: 4776)
      • drvinst.exe (PID: 8084)
      • drvinst.exe (PID: 7376)

    • Reads security settings of Internet Explorer

      • letsvpn-latest.exe (PID: 2772)
      • ShellExperienceHost.exe (PID: 7288)
      • tapinstall.exe (PID: 4776)
      • irsetup.exe (PID: 3884)

    • Reads the date of Windows installation

      • letsvpn-latest.exe (PID: 2772)
      • irsetup.exe (PID: 3884)

    • Process drops legitimate windows executable

      • irsetup.exe (PID: 3884)
      • LetsVPN.exe (PID: 2104)

    • The process drops C-runtime libraries

      • irsetup.exe (PID: 3884)

    • Drops 7-zip archiver for unpacking

      • irsetup.exe (PID: 3884)

    • The process creates files with name similar to system file names

      • LetsVPN.exe (PID: 2104)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • LetsVPN.exe (PID: 2104)

    • Starts CMD.EXE for commands execution

      • iusb3mon.exe (PID: 1672)
      • LetsVPN.exe (PID: 2104)
      • LetsPRO.exe (PID: 4728)

    • Probably obfuscated PowerShell command line is found

      • iusb3mon.exe (PID: 1672)

    • Removes files via Powershell

      • powershell.exe (PID: 4528)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 4528)

    • The process bypasses the loading of PowerShell profile settings

      • iusb3mon.exe (PID: 1672)

    • Base64-obfuscated command line is found

      • iusb3mon.exe (PID: 1672)

    • Starts POWERSHELL.EXE for commands execution

      • iusb3mon.exe (PID: 1672)
      • LetsVPN.exe (PID: 2104)
      • irsetup.exe (PID: 3884)

    • Manipulates environment variables

      • powershell.exe (PID: 4528)

    • There is functionality for VM detection VirtualBox (YARA)

      • iusb3mon.exe (PID: 1672)

    • There is functionality for VM detection Parallels (YARA)

      • iusb3mon.exe (PID: 1672)

    • There is functionality for taking screenshot (YARA)

      • iusb3mon.exe (PID: 1672)

    • There is functionality for VM detection VMWare (YARA)

      • iusb3mon.exe (PID: 1672)

    • Drops a system driver (possible attempt to evade defenses)

      • LetsVPN.exe (PID: 2104)
      • tapinstall.exe (PID: 4776)
      • drvinst.exe (PID: 8084)
      • drvinst.exe (PID: 7376)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 4528)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 4528)

    • The process executes Powershell scripts

      • LetsVPN.exe (PID: 2104)

    • Connects to unusual port

      • iusb3mon.exe (PID: 1672)

    • Reads the Windows owner or organization settings

      • irsetup.exe (PID: 3884)

    • Creates files in the driver directory

      • drvinst.exe (PID: 8084)
      • drvinst.exe (PID: 7376)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 7376)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 208)
      • cmd.exe (PID: 3868)
      • cmd.exe (PID: 7476)
      • cmd.exe (PID: 2240)

    • Creates a software uninstall entry

      • LetsVPN.exe (PID: 2104)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 6516)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 4220)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 6620)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 5760)

    • Suspicious use of NETSH.EXE

      • LetsPRO.exe (PID: 4728)

  • INFO

    • The sample compiled with english language support

      • letsvpn-latest.exe (PID: 2772)
      • irsetup.exe (PID: 3884)
      • LetsVPN.exe (PID: 2104)
      • tapinstall.exe (PID: 4776)
      • drvinst.exe (PID: 8084)
      • drvinst.exe (PID: 7376)

    • Checks supported languages

      • letsvpn-latest.exe (PID: 2772)
      • LetsVPN.exe (PID: 2104)
      • iusb3mon.exe (PID: 1672)
      • 7z.exe (PID: 132)
      • iusb3mon.exe (PID: 4628)
      • ShellExperienceHost.exe (PID: 7288)
      • tapinstall.exe (PID: 4776)
      • tapinstall.exe (PID: 2284)
      • irsetup.exe (PID: 3884)
      • drvinst.exe (PID: 8084)
      • drvinst.exe (PID: 7376)
      • tapinstall.exe (PID: 7420)
      • LetsPRO.exe (PID: 6880)
      • LetsPRO.exe (PID: 1128)
      • LetsPRO.exe (PID: 4728)
      • LetsPRO.exe (PID: 7512)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1472)
      • powershell.exe (PID: 7852)
      • powershell.exe (PID: 8124)
      • powershell.exe (PID: 4736)
      • powershell.exe (PID: 7704)
      • powershell.exe (PID: 7444)
      • powershell.exe (PID: 7956)

    • Create files in a temporary directory

      • letsvpn-latest.exe (PID: 2772)
      • irsetup.exe (PID: 3884)
      • LetsVPN.exe (PID: 2104)
      • iusb3mon.exe (PID: 1672)
      • SecEdit.exe (PID: 5116)
      • tapinstall.exe (PID: 4776)

    • Reads the computer name

      • letsvpn-latest.exe (PID: 2772)
      • irsetup.exe (PID: 3884)
      • LetsVPN.exe (PID: 2104)
      • 7z.exe (PID: 132)
      • iusb3mon.exe (PID: 1672)
      • ShellExperienceHost.exe (PID: 7288)
      • tapinstall.exe (PID: 4776)
      • drvinst.exe (PID: 7376)
      • drvinst.exe (PID: 8084)
      • LetsPRO.exe (PID: 6880)
      • LetsPRO.exe (PID: 4728)

    • Process checks computer location settings

      • letsvpn-latest.exe (PID: 2772)
      • irsetup.exe (PID: 3884)

    • Creates files or folders in the user directory

      • irsetup.exe (PID: 3884)
      • 7z.exe (PID: 132)
      • LetsVPN.exe (PID: 2104)

    • Creates files in the program directory

      • irsetup.exe (PID: 3884)
      • LetsVPN.exe (PID: 2104)
      • LetsPRO.exe (PID: 6880)
      • LetsPRO.exe (PID: 4728)

    • The sample compiled with chinese language support

      • irsetup.exe (PID: 3884)

    • Launch of the file from Registry key

      • iusb3mon.exe (PID: 1672)

    • UPX packer has been detected

      • iusb3mon.exe (PID: 1672)

    • Manual execution by a user

      • iusb3mon.exe (PID: 4628)

    • Process checks whether UAC notifications are on

      • iusb3mon.exe (PID: 1672)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7956)

    • Reads the machine GUID from the registry

      • tapinstall.exe (PID: 4776)
      • drvinst.exe (PID: 8084)
      • LetsPRO.exe (PID: 6880)
      • LetsPRO.exe (PID: 4728)

    • Reads the software policy settings

      • drvinst.exe (PID: 8084)
      • tapinstall.exe (PID: 4776)

    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 5416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2012:06:14 16:16:12+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 10
CodeSize: 25088
InitializedDataSize: 49664
UninitializedDataSize: -
EntryPoint: 0x2d1c
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 9.1.0.0
ProductVersionNumber: 9.1.0.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Created with Setup Factory
FileDescription: Setup Application
FileVersion: 9.1.0.0
InternalName: suf_launch
LegalCopyright: Setup Engine Copyright © 2004-2012 Indigo Rose Corporation
LegalTrademarks: Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFileName: suf_launch.exe
ProductName: Setup Factory Runtime
ProductVersion: 9.1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
214
Monitored processes
76
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start letsvpn-latest.exe irsetup.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs 7z.exe conhost.exe no specs iusb3mon.exe letsvpn.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs powershell.exe no specs conhost.exe no specs svchost.exe no specs svchost.exe no specs iusb3mon.exe no specs secedit.exe no specs shellexperiencehost.exe no specs powershell.exe no specs conhost.exe no specs tapinstall.exe no specs conhost.exe no specs tapinstall.exe conhost.exe no specs drvinst.exe drvinst.exe tapinstall.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs letspro.exe no specs letspro.exe no specs letspro.exe no specs letspro.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs route.exe no specs cmd.exe no specs conhost.exe no specs arp.exe no specs wmiapsrv.exe no specs netsh.exe no specs conhost.exe no specs slui.exe letsvpn-latest.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Users\admin\AppData\Roaming\..\Local\7z.exe" x -pmiyao123 -o"C:\Users\admin\AppData\Roaming\..\Local\AppData" "C:\Users\admin\AppData\Roaming\..\Local\7z.7z" "EduWebContainer.dll" -yC:\Users\admin\AppData\Local\7z.exe
irsetup.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
24.09
Modules
Images
c:\users\admin\appdata\local\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
208cmd /c netsh advfirewall firewall Delete rule name=lets.exeC:\Windows\SysWOW64\cmd.exe—LetsVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
644netsh advfirewall firewall Delete rule name=lets.exeC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1128"C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFrameworkC:\Program Files (x86)\letsvpn\LetsPRO.exe—LetsVPN.exe
User:
admin
Integrity Level:
HIGH
Description:
LetsVPN
Exit code:
0
Version:
3.12.0
Modules
Images
c:\program files (x86)\letsvpn\letspro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1472"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"360tray.exe\"));C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—irsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1672"C:\Users\admin\AppData\Local\AppData\iusb3mon.exe" C:\Users\admin\AppData\Local\AppData\iusb3mon.exe
irsetup.exe
User:
admin
Company:
腾讯科技(深圳)有限公司
Integrity Level:
HIGH
Description:
腾讯课堂
Version:
4, 6, 1, 2
Modules
Images
c:\users\admin\appdata\local\appdata\iusb3mon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ucrtbase.dll
1760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2104"C:\Program Files\Your Product\LetsVPN.exe" C:\Program Files\Your Product\LetsVPN.exe
irsetup.exe
User:
admin
Company:
Letsgo Network Incorporated
Integrity Level:
HIGH
Description:
LetsVPN Setup EXE
Exit code:
0
Version:
3.12.0.0
Modules
Images
c:\program files\your product\letsvpn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2240cmd /c netsh advfirewall firewall Delete rule name=LetsVPNC:\Windows\SysWOW64\cmd.exe—LetsVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
80 820
Read events
80 625
Write events
170
Delete events
25

Modification events

(PID) Process:(1672) iusb3mon.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicrosoftUSBMonitor
Value:
C:\Users\admin\AppData\Local\AppData\iusb3mon.exe
(PID) Process:(1672) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicrosoftUSBMonitor
Value:
C:\Users\admin\AppData\Local\AppData\iusb3mon.exe
(PID) Process:(5116) SecEdit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SecEdit
Operation:delete valueName:LastWinlogonConfig
Value:
(PID) Process:(2104) LetsVPN.exeKey:HKEY_CURRENT_USER\SOFTWARE\lets
Operation:writeName:InstallTimeStamp
Value:
20250531202542.232
(PID) Process:(2104) LetsVPN.exeKey:HKEY_CURRENT_USER\SOFTWARE\lets
Operation:writeName:InstallNewVersion
Value:
3.12.0
(PID) Process:(7288) ShellExperienceHost.exeKey:\REGISTRY\A\{4656478a-9af1-6fb2-c8f0-4bbb70d4c368}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000490168316AD2DB01
(PID) Process:(1672) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(1672) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(1672) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:PromptOnSecureDesktop
Value:
0
(PID) Process:(1672) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableLockWorkstation
Value:
0
Executable files
237
Suspicious files
40
Text files
39
Unknown types
5

Dropped files

PID
Process
Filename
Type
2772letsvpn-latest.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeexecutable
MD5:2A7D5F8D3FB4AB753B226FD88D31453B
SHA256:879109AE311E9B88F930CE1C659F29EC0E338687004318661E604D0D3727E3CF
3884irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPGimage
MD5:3220A6AEFB4FC719CC8849F060859169
SHA256:988CF422CBF400D41C48FBE491B425A827A1B70691F483679C1DF02FB9352765
7496powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w02ze22m.b1s.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3884irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.datbinary
MD5:64A19AFB2CB92B3F8F613A5216378B1D
SHA256:716A90B8CD2F37CC326B4F0A05E0046449AC48A2E29C24F1E87D26AE91A842D8
2772letsvpn-latest.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllexecutable
MD5:958103E55C74427E5C66D7E18F3BF237
SHA256:3EA4A4C3C6DEA44D8917B342E93D653F59D93E1F552ACE16E97E43BB04E951D8
7496powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0atq4t3e.rzp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1472powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4zueqc5a.ed0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7496powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:21B910915BD783A33C4D9ED03A4FAB90
SHA256:4AE8317DFBDB04BC743BD29C8D2EA56E69A39CC7FE7D5E6EE94262FBB30D6C00
7444powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ilk1bf4l.tsw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7852powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zgtyttma.u3n.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
125
DNS requests
30
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5400
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5400
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4728
LetsPRO.exe
GET
101
3.0.106.226:80
http://ws-ap1.pusher.com/app/4fc436ef36f4026102d7?protocol=5&client=pusher-dotnet-client&version=1.1.2
unknown
—
—
whitelisted
4728
LetsPRO.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEQCBTkIXoSl%2F7VrM1Bf4ka11
unknown
—
—
whitelisted
4728
LetsPRO.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2F09F%2BhHVuEUQQU2rONwCSQo2t30wygWd0hZ2R2C3gCDFxLOsCV0WoYXJJrOQ%3D%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5408
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1660
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5408
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.78
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.4
  • 40.126.31.128
  • 20.190.159.75
  • 40.126.31.3
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
littleblackbeae.com
  • 154.23.238.11
unknown

Threats

PID
Process
Class
Message
4728
LetsPRO.exe
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
letsvpn-latest.exe